Merit Circle

Line 62 calls `approve(_poolContract, type(uint256).max);` which means unlimited funds can be moved if something goes wrong.

An event should always be emitted when a state change is performed in order to facilitate smart contract monitoring by other systems which want to integrate with the smart contract. This is not the case for the functions: 1. `AbstractRewards._correctPointsForTransfer()` does not emit any event upon a successful change of the state variables `pointsCorrection[_from]` and `pointsCorrection[_to]`. 1. `AbstractRewards._correctPoints()` does not emit any event upon a successful change of the state variable `pointsCorrection[_account]`.

Certain contracts have special roles, which provide certain addresses with privileged roles. Such roles may pose a risk to end-users. The owner of the `TimeLockPool.sol` or `TimeLockNonTransferablePool.sol` contracts may perform the following privileged actions: 1. Give or revoke the role of `TOKEN_SAVER_ROLE` to any arbitrary address. 1. Call `saveToken()`, thereby transferring an arbitrary amount of an arbitrary token from the current contract to an arbitrary address. 1. Renounce ownership, by calling `renounceOwnership()`, thereby preventing the change of the currently set `TOKEN_SAVER_ROLE` role. 1. Transfer ownership (the role of `DEFAULT_ADMIN_ROLE`) to an arbitrary address. The owner of the `LiquidityMiningManager.sol` contract may perform the following privileged actions: 1. Give or revoke the role of `TOKEN_SAVER_ROLE` to any arbitrary address. 1. Call `saveToken()`, thereby transferring an arbitrary amount of an arbitrary token of the `LiquidityMiningManager.sol` contract to an arbitrary address. 1. Give or revoke the role of `GOV_ROLE` to any arbitrary address. 1. Add or remove pools, change pool weights or `rewardPerSecond`, by calling `addPool()`, `removePool()`, `adjustWeight()` and `setRewardPerSecond()` respectively. 1. Give or revoke the role of `REWARD_DISTRIBUTOR_ROLE` to any arbitrary address. 1. Distribute rewards by calling distributeRewards()`. 1. Renounce ownership, by calling `renounceOwnership(),` thereby preventing the change of the currently set `TOKEN_SAVER_ROLE`, `GOV_ROLE` and `REWARD_DISTRIBUTOR_ROLE` roles. 1. Transfer ownership (the role of `DEFAULT_ADMIN_ROLE`) to an arbitrary address. Note: As functions `addPool()`, `removePool()` and `adjustWeight()` call `distributeRewards()`, which is only callable by a reward distributor role holding account, it entails that the `GOV_ROLE` holding account will also hold the role of `REWARD_DISTRIBUTOR_ROLE`.